hugo - Debian Package Tracker

general

source: hugo (main)
version: 0.162.1-7
maintainer: Debian Go Packaging Team (DMD)
uploaders: Anthony Fok [DMD] – Dr. Tobias Quathamer [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.80.0-6
o-o-sec: 0.80.0-6+deb11u1
oldstable: 0.111.3-1
stable: 0.131.0-1
testing: 0.162.1-7
unstable: 0.162.1-7

versioned links

0.80.0-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.80.0-6+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.111.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.131.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.162.1-7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

hugo (3 bugs: 0, 3, 0, 0)

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:05:54
Last run: 2026-07-14T18:40:48.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:06:41
Last run: 2026-07-28T11:15:49.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 0:03:29
Last run: 2026-07-21T12:31:00.000Z
Previous status: unknown

Created: 2025-02-02 Last update: 2026-08-08 11:01

A new upstream version is available: 0.164.0 high

A new upstream version 0.164.0 is available, you should consider packaging it.

Created: 2026-07-15 Last update: 2026-08-08 06:01

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2026-58402: Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.
CVE-2026-58403: Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.
CVE-2026-58404: Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.

Created: 2026-07-07 Last update: 2026-08-02 20:32

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2026-58402: Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.
CVE-2026-58403: Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.
CVE-2026-58404: Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including integer, hex, or octal, passed the policy. When a template passes an untrusted or data-derived URL to resources.GetRemote and the host platform uses the cgo system resolver, these encodings resolve to the blocked address, allowing build-time server-side requests to loopback and internal services, including the cloud-metadata endpoint in hosted or CI builds; the same check is reused on redirects, so the gap also applies to each redirect hop. This issue is fixed in v0.163.1.

Created: 2026-07-07 Last update: 2026-08-02 20:32

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 6ccdaee2ff3af9aae4db0d8ca6c91c7fef363318
Author: Marcos Talau <talau@debian.org>
Date:   Mon Jul 20 00:34:21 2026 -0300

    debian/salsa-ci.yml: Add to provide CI tests for Salsa

https://salsa.debian.org/api/v4/projects/go-team%2Fpackages%2Fhugo API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-20 Last update: 2026-08-08 11:01

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-07-16 Last update: 2026-07-16 21:17

8 low-priority security issues in trixie low

There are 8 open security issues in trixie.

8 issues left for the package maintainer to handle:

CVE-2024-55601: (needs triaging) Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates: `_default/_markup/render-link.html` from `v0.123.0`; `_default/_markup/render-image.html` from `v0.123.0`; `_default/_markup/render-table.html` from `v0.134.0`; and/or `shortcodes/youtube.html` from `v0.125.0`. This issue is patched in v0.139.4. As a workaround, one may replace an affected component with user defined templates or disable the internal templates.
CVE-2026-35166: (needs triaging) Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2.
CVE-2026-44301: (needs triaging) Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. As a result, executing hugo against an untrusted site could allow code running through these tools to read or write files outside the project's working directory. Users who do not use PostCSS, Babel, or TailwindCSS, or who only build trusted sites, are not affected. This vulnerability is fixed in 0.161.0.
CVE-2026-50133: (needs triaging) Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup formats. Files mapped to the text/html media type (typically .html files under /content, or pages produced by a content adapter that sets content.mediaType = "text/html") had their body emitted verbatim into the rendered page. A site that ingests HTML content from an untrusted source could therefore be served stored cross-site scripting. This vulnerability is fixed in 0.162.0.
CVE-2026-50134: (needs triaging) Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server (or an attacker controlling its DNS or response) could therefore redirect the request to a host that the policy was meant to forbid and Hugo would fetch from the redirected target. The same bypass also lifted any host-shape restriction the operator had put in place. This vulnerability is fixed in 0.162.0.
CVE-2026-50135: (needs triaging) Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored themes/ theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.
CVE-2026-58402: (needs triaging) Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-…" data-lang="…" wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks out of the attribute and injects a live script element. This issue is fixed in 0.163.3.
CVE-2026-58403: (needs triaging) Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile "somefile" where somefile was a symlink pointing outside the mount would return the target's contents. This effectively let a symlink planted inside a theme or local mount read arbitrary files reachable to the user running hugo. This issue is fixed in v0.163.1.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-12-11 Last update: 2026-08-02 20:32

news

[rss feed]

[2026-07-21] hugo 0.162.1-7 MIGRATED to testing (Debian testing watch)
[2026-07-15] Accepted hugo 0.162.1-7 (source) into unstable (Jérémy Lal)
[2026-07-15] Accepted hugo 0.162.1-6 (source) into unstable (Jérémy Lal)
[2026-07-14] Accepted hugo 0.162.1-5 (source) into unstable (Jérémy Lal)
[2026-07-14] Accepted hugo 0.162.1-4 (source) into unstable (Jérémy Lal)
[2026-07-14] Accepted hugo 0.162.1-3 (source) into unstable (Jérémy Lal)
[2026-07-14] Accepted hugo 0.162.1-2 (source) into unstable (Jérémy Lal)
[2026-06-04] Accepted hugo 0.162.1-1 (source) into unstable (Dr. Tobias Quathamer)
[2026-05-16] hugo 0.161.1-1 MIGRATED to testing (Debian testing watch)
[2026-05-04] Accepted hugo 0.161.1-1 (source) into unstable (Dr. Tobias Quathamer)
[2026-05-04] hugo 0.161.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-28] Accepted hugo 0.161.0-1 (source) into unstable (Dr. Tobias Quathamer)
[2026-04-14] hugo 0.160.1-1 MIGRATED to testing (Debian testing watch)
[2026-04-11] hugo 0.160.0-2 MIGRATED to testing (Debian testing watch)
[2026-04-10] Accepted hugo 0.160.1-1 (source) into unstable (Dr. Tobias Quathamer)
[2026-04-08] Accepted hugo 0.160.0-2 (source) into unstable (Dr. Tobias Quathamer)
[2026-04-07] Accepted hugo 0.160.0-1 (source) into unstable (Dr. Tobias Quathamer)
[2026-04-06] hugo 0.159.2-1 MIGRATED to testing (Debian testing watch)
[2026-04-03] Accepted hugo 0.159.2-1 (source) into unstable (Dr. Tobias Quathamer)
[2026-04-03] hugo 0.159.1-1 MIGRATED to testing (Debian testing watch)
[2026-03-30] Accepted hugo 0.159.1-1 (source) into unstable (Dr. Tobias Quathamer)
[2026-03-28] hugo 0.159.0-1 MIGRATED to testing (Debian testing watch)
[2026-03-26] Accepted hugo 0.159.0-1 (source) into unstable (Dr. Tobias Quathamer)
[2026-03-22] hugo 0.158.0-3 MIGRATED to testing (Debian testing watch)
[2026-03-20] Accepted hugo 0.158.0-3 (source) into unstable (Dr. Tobias Quathamer)
[2026-03-19] Accepted hugo 0.158.0-2 (source) into unstable (Dr. Tobias Quathamer)
[2026-03-19] Accepted hugo 0.158.0-1 (source) into unstable (Dr. Tobias Quathamer)
[2026-03-04] hugo 0.157.0-3 MIGRATED to testing (Debian testing watch)
[2026-02-28] Accepted hugo 0.157.0-3 (source) into unstable (Dr. Tobias Quathamer)
[2026-02-28] Accepted hugo 0.157.0-2 (source) into unstable (Dr. Tobias Quathamer)

bugs [bug history graph]

all: 6
RC: 0
I&N: 6
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.162.1-7